Policy enforcement on multi-destination packets in a distributed tunnel fabric

Abstract

A system for policy management in a switch is provided. During operation, the system can generate, from a first policy defined for the switch, a second policy. The first policy can indicate whether a type of traffic is allowed from a source role to a destination role via an overlay tunnel. The second policy can indicate a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel. Upon identifying a host associated with a role at a port of the switch, the system can determine whether the role belongs to the plurality of destination roles based on the second policy. If the role belongs to the plurality of allowed destination roles, the system can allow the port to forward a multi-destination packet, which is received via the overlay tunnel and associated with the type of traffic.

What is claimed is: 
     
       1. A method comprising:
 receiving a first policy defined for a switch, wherein the first policy indicates whether a type of traffic is allowed from a source role of the traffic to a destination role of the traffic via an overlay tunnel associated with the switch; 
 generating, by the switch, a second policy from the first policy, wherein the second policy specifies a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel; 
 identifying a host associated with a first role at a first port of the switch; 
 applying the second policy for the multi-destination packets of the type of traffic at the first port by:
 determining, by the switch, whether the first role belongs to the plurality of destination roles by comparing the first role with the second policy; and 
 in response to the first role belonging to the plurality of destination roles, associating the first role with the first port for the type of traffic; 
 
 receiving, by the switch, a multi-destination packet associated with the type of traffic via the overlay tunnel; and 
 allowing the port to forward the multi-destination packet to the host based on the association between the first role and the first port. 
 
     
     
       2. The method of  claim 1 , further comprising, in response to the first role not belonging to the plurality of destination roles, precluding the first port from receiving the multi-destination packet by refraining from associating the first role with the first port for the type of traffic. 
     
     
       3. The method of  claim 1 , further comprising allocating, to the plurality of destination roles, a filter identifier that uniquely identifies the plurality of destination roles in a set of forwarding policies derived by the switch. 
     
     
       4. The method of  claim 3 , wherein determining whether the first role belongs to the plurality of destination roles further comprises determining whether the first role is associated with the filter identifier. 
     
     
       5. The method of  claim 3 , further comprising maintaining, in a storage medium of the switch, a data structure that maps the filter identifier to the plurality of destination roles. 
     
     
       6. The method of  claim 1 , further comprising:
 determining whether a packet from the host belongs to multi-destination traffic; and 
 in response to the packet belonging to multi-destination traffic, determining whether to allow the first port to forward the packet based on the type of traffic. 
 
     
     
       7. The method of  claim 6 , wherein, in response to the packet not belonging to multi-destination traffic, determining whether to forward the packet to a destination of the packet based on the first policy. 
     
     
       8. The method of  claim 1 , further comprising:
 determining a source role from a tunnel header encapsulating the multi-destination packet; and 
 identifying the second policy in a local data structure of the switch based on the source role and the type of traffic. 
 
     
     
       9. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:
 receiving a first policy defined for a switch, wherein the first policy indicates whether a type of traffic is allowed from a source role of the traffic to a destination role of the traffic via an overlay tunnel associated with the switch; 
 generating, at the switch, a second policy from the first policy, wherein the second policy specifies a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel; 
 to identifying a host associated with a first role at a first port of the switch; 
 applying the second policy for the multi-destination packets of the type of traffic at the first port by:
 determining, at the switch, whether the role belongs to the plurality of destination roles by comparing the role with the second policy; and 
 in response to the first role belonging to the plurality of destination roles, associating the first role with the first port for the type of traffic; 
 
 receiving, at the switch, a multi-destination packet associated with the type of traffic via the overlay tunnel; and 
 allowing the first port to forward the multi-destination packet to the host based on the association between the first role and the first port. 
 
     
     
       10. The non-transitory computer-readable storage medium of  claim 9 , wherein the method further comprises, in response to the first role not belonging to the plurality of destination roles, precluding the first port from receiving the multi-destination packet by refraining from associating the first role with the first port for the type of traffic. 
     
     
       11. The non-transitory computer-readable storage medium of  claim 9 , wherein the method further comprises allocating, to the plurality of destination roles, a filter identifier that uniquely identifies the plurality of destination roles in a set of forwarding policies derived at switch. 
     
     
       12. The non-transitory computer-readable storage medium of  claim 11 , wherein determining whether the first role belongs to the plurality of destination roles further comprises determining whether the first role is associated with the filter identifier. 
     
     
       13. The non-transitory computer-readable storage medium of  claim 11 , wherein the method further comprises maintaining, in a storage medium of the switch, a data structure that maps the filter identifier to the plurality of destination roles. 
     
     
       14. The non-transitory computer-readable storage medium of  claim 9 , wherein the method further comprises:
 determining whether a packet from the host belongs to multi-destination traffic; and 
 in response to the packet belonging to multi-destination traffic, determining whether to allow the first port to forward the packet based on the type of traffic. 
 
     
     
       15. The non-transitory computer-readable storage medium of  claim 14 , wherein, in response to the packet not belonging to multi-destination traffic, determining whether to forward the packet to a destination of the packet based on the first policy. 
     
     
       16. The non-transitory computer-readable storage medium of  claim 9 , wherein the method further comprises:
 determining a source role from a tunnel header encapsulating the multi-destination packet; and 
 identifying the second policy in a local data structure of the switch based on the source role and the type of traffic. 
 
     
     
       17. A computer system, comprising:
 a processor; 
 a non-transitory computer-readable storage medium storing instructions, which when executed by the processor causes the processor to perform a method, the method comprising:
 receiving a first policy defined for a computer system, wherein the first policy indicates whether a type of traffic is allowed from a source role of the traffic to a destination role of the traffic via an overlay tunnel associated with the computer system; 
 generating, at the computer system, a second policy from the first policy, wherein the second policy specifies a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel; 
 identifying a host associated with a first role at a first port of the computer system; 
 applying the second policy for the multi-destination packets of the type of traffic at the first port by:
 determining whether the first role belongs to the plurality of destination roles by comparing the first role with the second policy; and 
 in response to the first role belonging to the plurality of destination roles, associating the first role with the first port for the type of traffic; 
 
 receiving a multi-destination packet associated with the type of traffic via the overlay tunnel; and 
 allowing the first port to forward the multi-destination packet to the host based on the association between the first role and the first port. 
 
 
     
     
       18. The computer system of  claim 17 , wherein the method further comprises allocating, to the plurality of destination roles, a filter identifier for that uniquely identifies the plurality of destination roles in a set of forwarding policies derived by the computer system. 
     
     
       19. The computer system of  claim 18 , wherein determining whether the first role belongs to the plurality of destination roles further comprises determining whether the first role is associated with the filter identifier. 
     
     
       20. The computer system of  claim 17 , wherein the method further comprises:
 determining whether a packet from the host belongs to multi-destination traffic; and 
 in response to the packet belonging to multi-destination traffic, determining whether to allow the first port to forward the packet based on the type of traffic.